HTTP 431 Request Header Fields Too Large: fixes

What 431 means

The server refuses the request because its headers are too big: either one header field is over the limit, or all of them together are. 431 is defined in RFC 6585 §5, and the server can say in the body which header was the problem:

HTTP/1.1 431 Request Header Fields Too Large
Content-Type: text/html
Connection: close

<h1>Request Header Fields Too Large</h1>

Not every server uses 431 for this. nginx answers 400 "Request Header Or Cookie Too Large", and Apache answers 400 "Size of a request header field exceeds server limit". The cause and the fix are the same.

Common causes

Too many or too large cookies. Every cookie for the domain is sent on every request; analytics, A/B testing and session cookies add up, and a cookie set on .example.com is sent to every subdomain too.
localhost during development. Cookies from every app you've run on localhost pile up, and Node.js dev servers (React, Next.js, Vite) answer 431 once they pass 16 KB.
Large tokens in headers: JWTs with many claims in Authorization, or SAML data forwarded as headers.
A very long Referer carrying a huge query string.
Proxies adding headers (X-Forwarded-For chains, tracing headers) on top of an already large request.

How to fix it as a user

Clear the cookies for that site (in Chrome: the site settings icon in the address bar, then Cookies and site data), then reload. For localhost, clear its cookies or open the app in a private window.

How to fix it on the server

First shrink what the client sends: keep session data on the server and store only an ID in the cookie, set cookies on the narrowest path and domain, delete unused ones, and keep tokens small. Then raise limits if you still need to.

Node.js (default 16 KB for all headers):

node --max-http-header-size=32768 server.js

or http.createServer({ maxHeaderSize: 32768 }, app).

nginx: large_client_header_buffers sets how many buffers and how large each is; one header line must fit in one buffer. The default is 4 8k:

http {
    large_client_header_buffers 4 32k;
}

Apache: LimitRequestFieldSize (8190 bytes per header by default) and LimitRequestFields (100 headers).

LimitRequestFieldSize 16380

Go: http.Server{MaxHeaderBytes: ...}, 1 MB by default; Go answers 431 above it.

Raise the limit on every hop: a CDN or load balancer in front has its own.

431 and SEO

Googlebot doesn't keep cookies between requests and sends small headers, so it rarely triggers 431. If it does, Google treats it like any 4xx other than 429 and drops the URL from the index. Users with many cookies are the ones who usually hit it.

413 Content Too Large: the body, not the headers, is too big.
400 Bad Request: what nginx and Apache send for the same problem.
414 URI Too Long: the URL itself is too long.
494 Request Header Too Large: nginx's internal code for this; the client gets a 400 page.

To see the headers a request carries and test a server's limits, use the HTTP Request Builder.